Bug 1173555 (CVE-2014-7824)

Summary: CVE-2014-7824 dbus: local denial of service via incomplete fix for CVE-2014-3636
Product: [Other] Security Response Reporter: Vasyl Kaigorodov <vkaigoro>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: amigadave, dking, drizt72, erik-fedora, jrusnack, lpoetter, slawomir, walters
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Fixed In Version: dbus 1.6.26, dbus 1.8.10, dbus 1.9.2 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-12-12 23:32:21 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1173556, 1173557, 1173558    
Bug Blocks: 1140534, 1160627    
Description Flags
0002-Set-fd-rlimit-to-64k-for-the-system-dbus-daemon.patch none

Description Vasyl Kaigorodov 2014-12-12 12:12:07 UTC
The patch issued by the D-Bus maintainers for CVE-2014-3636 was based on
incorrect reasoning, and does not fully prevent the attack described as
"CVE-2014-3636 part A", which is repeated below. Preventing that attack
requires raising the system dbus-daemon's RLIMIT_NOFILE (ulimit -n) to a
higher value.

To avoid propagating that higher limit to activatable system services,
it is desirable to start the system dbus-daemon as root so it can store
its previous limit, raise its limit, drop root privileges (which its
default configuration will do automatically), and restore the previous
limit before launching activatable services. Some operating system
distributions, such as anything using the upstream-supplied systemd
units, start the system dbus-daemon as root already; others, such as
Debian 7, currently start the system dbus-daemon under its less
privileged uid and will need minor modifications to their init scripts.

Suggested patches are attached. Patch 0001 is not strictly required, but
if it is skipped, it will be necessary to replace each occurrence of

Attack details (repeating CVE-2014-3636 part A):

By queuing up the maximum allowed number of fds, a malicious sender
could reach the system dbus-daemon's RLIMIT_NOFILE (ulimit -n, typically
1024 on Linux). This would act as a denial of service in two ways:

* new clients would be unable to connect to the dbus-daemon
* when receiving a subsequent message from a non-malicious client that
  contained a fd, dbus-daemon would receive the MSG_CTRUNC flag,
  indicating that the list of fds was truncated; kernel fd-passing APIs
  do not provide any way to recover from that, so dbus-daemon responds
  to MSG_CTRUNC by disconnecting the sender, causing denial of service
  to that sender

Comment 1 Vasyl Kaigorodov 2014-12-12 12:13:27 UTC
Created dbus tracking bugs for this issue:

Affects: fedora-all [bug 1173556]

Comment 2 Vasyl Kaigorodov 2014-12-12 12:13:30 UTC
Created mingw-dbus tracking bugs for this issue:

Affects: fedora-all [bug 1173557]
Affects: epel-7 [bug 1173558]

Comment 3 Vasyl Kaigorodov 2014-12-12 12:16:16 UTC
Created attachment 967617 [details]

Comment 4 Vasyl Kaigorodov 2014-12-12 12:16:57 UTC
Created attachment 967618 [details]

Comment 5 Vincent Danen 2014-12-12 14:27:27 UTC
Original report to oss-security:


Comment 6 Vincent Danen 2014-12-12 14:29:21 UTC
Note that CVE-2014-3636 (bug #1140525) was not previously corrected by any errata.

Comment 7 Vincent Danen 2014-12-12 23:32:21 UTC
As no prior Red Hat Enterprise Linux release contains the incorrect fix, they are not affected by this particular CVE.  See bug #1140525 for details.

Comment 8 Fedora Update System 2014-12-13 09:47:46 UTC
dbus-1.6.28-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 9 Fedora Update System 2014-12-17 04:46:54 UTC
dbus-1.8.12-1.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 10 Fedora Update System 2014-12-19 18:26:22 UTC
dbus-1.6.28-1.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.